On Thu, 22 Jan 2009 15:00:43 -0600, Les Mikesell wrote:
> An occasional clamav scan can't hurt.
You are absolutely, completely wrong.
Clamav has had vulnerabilities that could be used to cause it to execute
arbitrary code in the scanned files. I don't doubt for one second that
proprietary AVs have the same kind of problem, except that you can't look
at the code to check for yourself.
While the risk is worth taking when you are implementing a mail server or
a Samba server, our PCI-DSS consultant is pushing us to have Clamav (or a
proprietary product) installed on every single one of our servers in the
PCI scope, even though there is not a single Windows machine in the
scope.
The likelyhood of an actual _virus_ infection is 0 for us. I don't mean
malware -- I mean virus. The problem is that while PCI-DSS 1.2 now
mentions malware as a whole, it still requires "antivirus" software,
while only giving a weak "if applicable" exception. We are told we can't
use it since there is at least a handful of known Linux viruses
(nevermind that they are never seen in the wild) which could simply *not*
infect us, since they require, by definition, that we run an infected
binary. Running chkrootkit or tripwire or even rpmverify *is* useful, but
it doesn't cover the "antivirus" requirement, we are told.
So we're going to go ahead and weaken our security just to check a PCI-
DSS checkbox. This is simply ridiculous.
PS: I want to emphasize that by "virus" I mean "virus," not "worm" or
"rootkit" or "malware" or "exploit." There are sploits, worms and
rootkits on Linux, some are/have been quite nasty; there has *never* been
an actual virus threat.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
